CVE-2025-54768

CVE-2025-54768 affects Xorux LPAR2RRD (versions 8.04 and prior). An API endpoint intended for web application administrators is accessible to lower-level read-only users, enabling download of appliance configuration logs and exposure of sensitive information (e.g., password hashes). The vulnerabi...

PT-2025-31205 · Undefined · Undefined

A stack-based buffer overflow vulnerability exists in i-Ftp version 2.20 due to improper handling of the Time attribute within Schedule.xml. By placing a specially crafted Schedule.xml file in the i-Ftp application directory, a remote attacker can trigger a buffer overflow during scheduled downlo...

CVE-2025-8071 Mine CloudVod <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via audio Parameter

Mine CloudVod plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘audio’ parameter in all versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-42947

CVE-2025-42947 concerns SAP FICA ODN framework. The vulnerability allows a high-privileged user to inject a value into a local variable, which can be executed by the application, potentially altering behavior. Impact is described as high integrity impact, low availability impact, and no confident...

CVE-2025-43976

The com.enflick.android.tn2ndLine application through 24.17.1.0 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.enflick.android.TextNow.activities.DialerActivity component...

CVE-2025-6741

creationtimestamp| type| source ---|---|--- 2025-07-22 21:28:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lulh57aka32i...

CVE-2025-51859

creationtimestamp| type| source ---|---|--- 2025-07-22 17:06:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lukyi4jrd32b...

CVE-2025-7644

The Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URLs in all widgets in all versions up to, and including, 1.6.7 due to insufficient input...

CVE-2025-52580

The vulnerability CVE-2025-52580 affects the region PAY App for Android (Gift Pad Co., Ltd.) prior to version 1.5.28. Cause: insertion of sensitive information into log files (CWE-532). Impact: sensitive user data could be exposed to an attacker who gains access to application logs. Mitigation: u...

The vulnerability of the Behavioral DoS (BADoS) function of the BIG-IP Application Security Manager allows a attacker to cause a service failure.

The vulnerability of the Behavioral DoS BADoS function of the BIG-IP Application Security Manager protection tool is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

GHSA-59G8-H59F-8HJP NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site Scripting

Summary The NodeJS version of HAX CMS has a disabled Content Security Policy CSP. This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks. Details The contentSecurityPolicy value is explicitly disabled in the application's Helme...

NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site Scripting

Summary The NodeJS version of HAX CMS has a disabled Content Security Policy CSP. This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks. Details The contentSecurityPolicy value is explicitly disabled in the application's Helme...

CVE-2025-24936

The web application allows user input to pass unfiltered to a command executed on the underlying operating system. The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet. An attacker with low privileged access to th...

CVE-2025-43977

The com.skt.prod.dialer application through 12.5.0 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.skt.prod.dialer.activities.outgoingcall.OutgoingCallInternalBroadcaster component...

PHPGurukul Online Banquet Booking System 安全漏洞

Online Banquet Booking System is an online banquet booking system. A cross-site scripting vulnerability exists in Online Banquet Booking System, which originates from the failure to strictly filter the adminname parameter in the /admin/admin-profile.php file. An attacker can exploit this...

Exploit for Cross-site Scripting in Campcodes Online_Movie_Theater_Seat_Reservation_System

XSS Exploit for CVE-2025-7840 Author: Byte Reaper @ByteR...

CVE-2025-53934

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the control.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject...

XWiki < 15.10.16, 16.0.0-rc-1 < 16.4.7, 16.5.0-rc-1 < 16.10.2 Multiple Vulnerabilities

Xwiki is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescription...

Oracle GoldenGate for Big Data Multiple Vulnerabilities 23.x < 23.9.0.25.07 (July 2025 CPU)

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities: - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate component: Java Delivery Netty...

PT-2025-29815 · Unknown · Ezihosting Tennis Court Bookings

Name of the Vulnerable Software and Affected Versions: EZiHosting Tennis Court Bookings versions through 1.2.7 Description: The software contains a Reflected Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. This allows an attacker to inject...